jscrambler 8.11.2 → 8.12.0-next.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # jscrambler
 
+## 8.12.0-next.0
+
+### Minor Changes
+
+- [83c2f6f]: Added suport for new code hardening
+
+## 8.11.3
+
+### Patch Changes
+
+- [25054ca]: Ensure protected files are not written outside of project root folder in gulp
+
 ## 8.11.2
 
 ### Patch Changes

package/dist/bin/jscrambler.js

@@ -198,6 +198,12 @@ try {
   console.error(err.message);
   process.exit(1);
 }
+try {
+  config.codeHardening = (0, _utils.validateCodeHardening)(config.codeHardening);
+} catch (err) {
+  console.error(err.message);
+  process.exit(1);
+}
 // Merge file config with CLI `--custom-label` flags (CLI wins on duplicate keys)
 config.customLabels = _objectSpread(_objectSpread({}, config.customLabels), _commander.default.customLabel || {});
 if (Object.keys(config.customLabels).length === 0) {
@@ -290,6 +296,7 @@ const {
   debugMode,
   proxy,
   codeHardeningThreshold,
+  codeHardening,
   useProfilingData,
   profilingDataMode,
   browsers,
@@ -436,6 +443,7 @@ if (_commander.default.balance) {
       tolerateMinification,
       debugMode,
       codeHardeningThreshold,
+      codeHardening,
       useProfilingData,
       profilingDataMode,
       browsers,

package/dist/cleanup-input-fields.js

@@ -19,6 +19,6 @@ function cleanupInputFields(args, fragments) {
       console.warn("Warning: This API Version does not support the '".concat(field, "' argument."));
     }
   }
-  ['tolerateMinification', 'useProfilingData', 'useAppClassification', 'inputSymbolTable', 'entryPoint', 'ensureCodeAnnotation', 'generateAlias', 'customLabels'].forEach(fieldCleanUp);
+  ['tolerateMinification', 'useProfilingData', 'useAppClassification', 'inputSymbolTable', 'entryPoint', 'ensureCodeAnnotation', 'generateAlias', 'customLabels', 'codeHardening'].forEach(fieldCleanUp);
   return [options, cleanedUpFragments];
 }

package/dist/constants.js

@@ -20,6 +20,7 @@ const CLIENT_IDS = exports.CLIENT_IDS = Object.freeze({
   WEBPACK: 2,
   GULP: 3,
   GRUNT: 4,
+  /* @deprecated */
   EMBER: 5,
   METRO: 6
 });
@@ -29,6 +30,7 @@ const CLIENT_PACKAGES = exports.CLIENT_PACKAGES = Object.freeze({
   [CLIENT_IDS.WEBPACK]: 'jscrambler-webpack-plugin',
   [CLIENT_IDS.GULP]: 'gulp-jscrambler',
   [CLIENT_IDS.GRUNT]: 'grunt-jscrambler',
+  /* @deprecated */
   [CLIENT_IDS.EMBER]: 'ember-cli-jscrambler',
   [CLIENT_IDS.METRO]: 'jscrambler-metro-plugin'
 });

package/dist/index.js

@@ -112,6 +112,7 @@ function buildFinalConfig(configPathOrObject) {
 var _default = exports.default = {
   Client: _client.default,
   config: _config2.default,
+  resolveOutputPath: _utils.resolveOutputPath,
   queries,
   generateSignedParams: _generateSignedParams.default,
   /**
@@ -273,6 +274,7 @@ var _default = exports.default = {
       clientId,
       tolerateMinification,
       codeHardeningThreshold,
+      codeHardening,
       useProfilingData,
       browsers,
       useAppClassification,
@@ -328,6 +330,7 @@ var _default = exports.default = {
     if (!filesDest && !destCallback) {
       throw new Error('Required *filesDest* not provided');
     }
+    const normalizedCodeHardening = (0, _utils.validateCodeHardening)(codeHardening);
     let source;
     if (!skipSources) {
       const appProfiling = await this.getApplicationProfiling(client, applicationId).catch(e => {
@@ -367,6 +370,9 @@ var _default = exports.default = {
       tolerateMinification,
       codeHardeningThreshold
     };
+    if (typeof normalizedCodeHardening !== 'undefined') {
+      updateData.codeHardening = normalizedCodeHardening;
+    }
     if (params && Object.keys(params).length) {
       updateData.parameters = normalizeParameters(params);
       updateData.areSubscribersOrdered = Array.isArray(params);

package/dist/utils.js

@@ -7,6 +7,8 @@ exports.PREPEND_JS_TYPE = exports.APPEND_JS_TYPE = void 0;
 exports.concatenate = concatenate;
 exports.getMatchedFiles = getMatchedFiles;
 exports.isJavascriptFile = isJavascriptFile;
+exports.resolveOutputPath = resolveOutputPath;
+exports.validateCodeHardening = validateCodeHardening;
 exports.validateCustomLabels = validateCustomLabels;
 exports.validateNProtections = validateNProtections;
 exports.validateThresholdFn = void 0;
@@ -16,6 +18,11 @@ var _fs = _interopRequireDefault(require("fs"));
 var _path = require("path");
 var _filesizeParser = _interopRequireDefault(require("filesize-parser"));
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+function _defineProperty(e, r, t) { return (r = _toPropertyKey(r)) in e ? Object.defineProperty(e, r, { value: t, enumerable: !0, configurable: !0, writable: !0 }) : e[r] = t, e; }
+function _toPropertyKey(t) { var i = _toPrimitive(t, "string"); return "symbol" == typeof i ? i : i + ""; }
+function _toPrimitive(t, r) { if ("object" != typeof t || !t) return t; var e = t[Symbol.toPrimitive]; if (void 0 !== e) { var i = e.call(t, r || "default"); if ("object" != typeof i) return i; throw new TypeError("@@toPrimitive must return a primitive value."); } return ("string" === r ? String : Number)(t); }
 /**
  * Return the list of matched files for minimatch patterns.
  * @param {string} pattern
@@ -70,6 +77,22 @@ function validateCustomLabels(customLabels) {
   }
   return out;
 }
+
+/**
+ * Validate protection `codeHardening` is a plain object; API validates contents.
+ * @param {*} codeHardening From config or programmatic options.
+ * @returns {object|undefined} A shallow copy when valid; `undefined` when omitted.
+ * @throws {Error} If `codeHardening` is present but not a plain object.
+ */
+function validateCodeHardening(codeHardening) {
+  if (typeof codeHardening === 'undefined') {
+    return undefined;
+  }
+  if (codeHardening === null || typeof codeHardening !== 'object' || Array.isArray(codeHardening)) {
+    throw new Error('Invalid *codeHardening*: expected a plain object.');
+  }
+  return _objectSpread({}, codeHardening);
+}
 const APPEND_JS_TYPE = exports.APPEND_JS_TYPE = 'append-js';
 const PREPEND_JS_TYPE = exports.PREPEND_JS_TYPE = 'prepend-js';
 
@@ -128,4 +151,13 @@ const validateThresholdFn = optionName => val => {
   }
   return inBytes;
 };
-exports.validateThresholdFn = validateThresholdFn;
+exports.validateThresholdFn = validateThresholdFn;
+function resolveOutputPath(outputPath, filename) {
+  const outputRoot = (0, _path.resolve)(outputPath);
+  const finalPath = (0, _path.resolve)(outputRoot, filename);
+  const relativePath = (0, _path.relative)(outputRoot, finalPath);
+  if (relativePath === '..' || relativePath.indexOf("..".concat(_path.sep)) === 0 || (0, _path.isAbsolute)(relativePath)) {
+    throw new Error("Refusing to write file outside output directory: ".concat(filename));
+  }
+  return finalPath;
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "jscrambler",
   "description": "Jscrambler Code Integrity API client.",
-  "version": "8.11.2",
+  "version": "8.12.0-next.0",
   "homepage": "https://github.com/jscrambler/jscrambler",
   "author": "Jscrambler <support@jscrambler.com>",
   "repository": {
@@ -61,6 +61,7 @@
     "clean": "rm -rf ./dist",
     "build": "babel src --out-dir dist",
     "watch": "babel -w src --out-dir dist",
+    "test": "pnpm run build && node test/output-path.js",
     "prepublish": "npm run build",
     "eslint": "eslint src/",
     "eslint:fix": "eslint src/ --fix"